NSFG_2020_PWS_8April2020.pdf

Section C - Description/Specification/Work Statement C.1 Performance Work Statement

Note: Acronyms in this document are spelled out for the first occurrence and are also listed in Attachment 10.

Contents

2. Background: The Uses of the NSFG

3. Purpose of Contract

3.1 Summary of the Work

3.2 Principal Concerns

3.2.1 Continuity and responsiveness

3.2.2 Continuity and modernization

3.2.3 Cost control and proactive management of fieldwork

3.2.4 Efficiency of data processing and data file documentation

3.2.5 Collection of sensitive data

3.2.6 Collection of data requiring cognitively challenging tasks

4. Specifications for Work Tasks: Baseline through release of first Public Use File (PUF) (Sept 2020 through Dec 2024)

4.1 Overview

4.2 Communication with NCHS

4.3 Information Security, Confidentiality, Disclosure Risk and Access to Confidential Data

4.3.1 Information Security, Confidentiality, and Disclosure Risk

4.3.2 NCHS Confidentiality Requirements

4.4. Sample Design

4.5. Preparation for Data Collection

4.6 Data Collection

4.7 Data Preparation

4.8. Data Files (Deliverables K1-K9)

4.9 Methodology Reports

4.10 Experiments

4.11 Performance-Based Matrix

4.12 Optional Contract Tasks

5. Specifications for Work Tasks: Preparation for fieldwork for second/third/fourth PUFs, through release of second/third/fourth PUFs

6. Contract Closeout

7. ATTACHMENTS

Clause for 508 Compliance F.4.1 Schedule of Deliverables

1. Introduction

The National Center for Health Statistics (NCHS), Division of Vital Statistics requires the planning and conduct of the National Survey of Family Growth (NSFG), with interviewing to be conducted continuously from January 2022 through December 2029. Working closely and collaboratively with the NCHS/NSFG work team to develop materials and specifications, the contractor shall conduct all the necessary activities, including sample design, CAI programming, preparing interviewer training materials, hiring, supervising and training interviewers, data processing, developing weights and sample design variables, data file preparation, and data file documentation, for a complete nationally representative survey.

This contract requires that the NSFG interviewing will be continuous from January 2022 to December 2029, producing approximately 5,000 in-person interviews per year with men and women 15-49 years of age, offering Spanish language interviewing as well as English. The contract is structured in approximately annual phases. If feasible and cost-effective, each annual sample would comprise a nationally representative survey. Over the life of this contract, about 40,000 men and women will be interviewed in person in 8 years, and data files will be released for 2 years of interviews at a time. Thus, this contract calls for the preparation of 4 public use data files. (NCHS requires each 2-year data file to contain at least 10,000 interviews.)

Offerors are expected to be familiar with the contents of the NSFG website and with the most recent methodology documents posted or published by NCHS (see end of section 3.1).

The NSFG is part of a series of in-person, face-to-face surveys based on national probability samples that began in 1955. From 1955-1995, the surveys were limited to women of reproductive age. In 1955 and 1960, the surveys were conducted by private organizations. In 1965 and 1970, they were conducted by university researchers with federal funding. Beginning in 1973, NCHS assumed responsibility for the surveys as part of the federal statistical system. Since then, these surveys have been conducted as follows by NCHS:

Periodic surveys from 1973-2002 (Cycles 1-6):

• Cycles 1 (1973) and 2 (1976) with ever-married women 15-44 years of age

• Cycles 3 (1982), 4 (1988), and 5 (1995) with women 15-44 years of age, regardless of marital experience

• Cycle 6 (2002) with men and women 15-44 years of age

After a transition to a continuous fieldwork design in June 2006, NSFG file releases began to be referred to by the survey years and not “cycles.” A 2-year file release plan was begun in with 2011-2013, and the 15-44 age range for the survey of men and women was expanded in September 2015 to ages 15-49:

• 2006-10 NSFG (released Oct 2011)

• 2011-2013 NSFG (released Dec 2014)

• 2013-2015 NSFG (released Oct 2016)

• 2015-2017 NSFG (released Dec 2018)

• 2017-2019 NSFG (to be released late 2020)

In each NSFG, respondents have been interviewed in person in their own homes by trained professional female interviewers. In the latest NSFG releases for 2015-2017 and 2017-2019, during fieldwork 2011 to 2019, interview length averaged 49 minutes for males and 75 minutes for females. Since the 1995 NSFG (Cycle 5), the NSFG has been conducted using Computer-Assisted Interviewing (CAI) with an interviewer-administered portion using computer-assisted personal interviewing (CAPI) and a self-administered portion using Audio Computer-Assisted Self-Interviewing (ACASI). CAPI and ACASI will be used again as the default in this contract, unless and until superior alternatives are available.

2. Background: The Uses of the NSFG The original purpose of the NSFG as part of the federal statistical system was to respond to Section 306 of the Public Health Service Act, stipulating that “NCHS shall collect statistics… on family formation, growth, and dissolution.” Since 1973, the NSFG has been a principal source of national estimates of factors affecting pregnancy and birth rates, including sexual activity, cohabitation, marriage, and divorce, frequency of intercourse, https://www.cdc.gov/nchs/nsfg/index.htm contraceptive use for both birth control and disease prevention, miscarriage and stillbirth (aka pregnancy loss), infertility, wanted and unwanted births, and use of medical services for family planning and infertility. The NSFG’s core mission since 1973 has therefore been to collect data from national samples of women (and later also men) that would help to explain trends and differentials in birth and pregnancy rates. Over time, with changes in society and emerging data needs, NSFG’s purpose has grown to providing a broader range of statistics to the federal programs that support the survey. Those data include further topics supporting the original survey emphasis on pregnancy and childbearing, and newer concerns with STD and HIV risk behaviors, and fatherhood involvement. For example, NSFG content has evolved to address data needs of key cosponsors of the survey:

• The Office of Population Affairs (OPA), which is concerned with teenage sexual activity and pregnancy and the use of Title X Family Planning Services. OPA is also the lead agency for the Healthy People 2030 objectives on Family Planning (Focus Area 9), and the NSFG is the major data source for those objectives;

• NICHD, which uses the survey to inform and shape its extramural (grant) research programs related to fertility, contraception, reproductive health, and family formation in the US, and to provide a data resource for private and university-based researchers;

• Other programs, including the HIV and STD Prevention programs of the CDC, which need reliable information on the sexual and drug-related behaviors that increase the risk of HIV and STD transmission in the general population of the US; the Division of Reproductive Health, CDC, which has interests in teen and unintended pregnancy, and the Children’s Bureau’s interest in adoption.

Thus, this contract will require the collection of a wide range of sensitive data, that

(a) must be collected from national samples continuously over an 8-year period;

(b) must be as comparable as possible with data collected in earlier cycles;

(c) must measure trends and differences among the total population and important sub-groups,

(d) provides a response rate (and other sample properties) that gives its users confidence in the results, and

(e) is at a cost that NCHS and its co-funders can afford.

3. Purpose of Contract The Division of Vital Statistics, National Center for Health Statistics (NCHS) requires that the National Survey of Family Growth (NSFG) be conducted. This procurement will satisfy NCHS requirements for data to respond to Section 306 of the Public Health Service Act, and for data to serve the needs of roughly 10 other co-sponsoring DHHS programs. NCHS has conducted the NSFG periodically since 1973 to provide national data on factors related to birth and pregnancy rates, maternal and child health, reproductive and sexual health, and parenting. These data supplement and complement data from the DVS/NCHS National Birth registration statistics.

All work under this contract shall be performed within the fifty (50) states and the District of Columbia. The Contractor shall furnish the necessary personnel, material, equipment, services and facilities (except as otherwise specified), to perform the work described below.

3.1 Summary of the Work

The contractor shall conduct interviewing, data processing, and data file documentation for the NSFG. Interviewing shall be conducted from January 2022 to December 2029, based upon approximately 5,000 completed interviews per year with men and women 15-49 years of age in the household population of the United States. In summary, the contractor shall perform the following tasks, working in close, continuing collaboration with the NCHS/NSFG staff:

(1) Design a national sample that will yield about 5,000 interviews per year with men and women 15- 49 years of age for up to 8 years (January 2022 through December 2029), for a total of about 40,000 interviews: one with no oversampling of population subgroups and, to meet analytic objectives, one with oversampling of teenage (age 15-19) individuals and oversampling of non- Hispanic black and Hispanic men and women (Section 4.4; Deliverables C1, C2) ;

(2) Program and test screener questionnaire and protocol, incorporating/testing other modes as needed

(Section 4.5.1, 4.10; Deliverables X1, X2, L1); program and test main questionnaires for males and females (for face-to-face mode on laptops) (Section 4.5.1; Deliverables D1-D4);

(see 5a and 5b below);

(3) Prepare advance letters, consent forms, and other survey field materials

(Section 4.5.2.3, Deliverables E1-E3 and F1-F3);

(4) Recruit, hire, and train interviewers (Section 4.5.2, 4.5.3, Deliverables G1-G3, Attachments 7, 8), including mandatory security clearances for interviewers prior to beginning fieldwork (Section 4.3);

(5a) Conduct screeners using methods shown to be most effective for gaining contact and achieving screener goals, while not undermining main interview goals. Methods can include those not used in previous NSFGs (e.g.: face to face, mail, web, mixed-sequential) (Section 4.6, 4.10; Deliverable X1, X2, L1);

(5b) Conduct main interviews prioritizing face-to-face mode (Section 4.6, Deliverables H1-H6), but proposing an experiment for other methods/mode(s) for gaining cooperation, maximizing response rates/minimizing nonresponse bias, minimizing costs, while maintaining data quality and continuity of estimates (ex: mailed/phone/online/mixed mode screeners; online option for main interview nonresponders) (Section 4.10; Deliverable M2);

Face to face interviews shall typically be in respondents’ homes, collecting signed consent for the interview for all respondents, and signed parental consent for interviews with 15-17 year olds;

(6) Achieve response rates for both men and women of at least 60%. Response rates are an important aspect of data collection outcomes to be balanced with other metrics such as nonresponse bias and sample balance, but a response rate of 60% should be considered a minimum. Include design features to minimize nonresponse bias (Section 4.4.3, 4.6.7);

(7) Use laptop computers (and/or potentially other devices/hardware as described elsewhere in this

PWS) to conduct the interviews. Regardless of mode, hardware, and software used to collect responses, send the (encrypted) data electronically to the contractor’s central office as promptly as possible (Section 4.3, 4.5);

(8) Prepare 4 public use data files and supplementary files with complete documentation based on every 2 years of interviewing, which, if expected yields are met, would include data based on at least 10,000 interviews (Section 4.4, 4.8; Deliverables K1-K9);

(9) Prepare reports describing the plan and operation of the survey, sample design, weighting, imputation, and variance estimation, and any other features necessary to describe the work that was done. Information from these reports will be posted on the NSFG website (section 4.9, 4.10;

Deliverables L1-L4);

(10) Meet requirements for IT and data security and confidentiality per CDC OCISO /NCHS ISSO and

Office of Confidentiality requirements (Section 4.3; Deliverables A1-A6); and

(11) Keep NCHS informed as the work proceeds so that NCHS can give timely and appropriate technical direction. (Section 4.2; Deliverables B1-B3, H1-H7).

These tasks are described in more detail below, but this contract requires the services of a survey firm that has experience in data collection for complex, computer-assisted national surveys based on in-person interviews involving cognitively challenging questions and very sensitive topics. Ideally, the firm would have experience converting face-to-face screener and main interview instruments to other modes including web-based, telephone, and mail, and would have experience using those methods of survey administration successfully. The firm must be able to select a national sample, staff the project in any state, and conduct the interviews in English and Spanish. It must meet Certification and Accreditation requirements for Information Technology security and be able to adapt to an increasingly challenging survey environment in the United States. The firm must also have fieldwork information systems that allow them to ration and control interviewer labor and other spending, in order to control costs and improve quality.

The project shall be designed to produce high-quality 2-year data files with sufficient statistical power to allow for stable national estimates on topics central to the NSFG’s mission. For some topics it may be necessary to combine four years of data to obtain reliable estimates. Examples of these critical topics include:

• determinants of birth and pregnancy rates, including sexual activity, contraceptive use, infertility, sterilization, and miscarriage

• family formation and dissolution, including marriage, divorce, cohabitation, and non-biological parenting/adoption

• use of medical services for birth control, infertility, sterilization, and selected health screening for both men and women

• behaviors related to the risk of HIV and other sexually transmitted infections.

Offerors may gain a better understanding of the NSFG’s mission and how the data have been disseminated and used by consulting the following resources on the NSFG webpage:

• Data and documentation for every NSFG file release since 1973 are available on the NSFG webpage.

Documentation includes codebooks, user’s guides, and other relevant information to assist data users in conducting their own analyses with each NSFG.

• The NSFG webpage also includes full NSFG bibliographies including reports on the methodology of the survey, as well as research using the NSFG data; these bibliographies are organized by survey years. The NSFG webpage includes links for all NCHS reports in PDF format.

• The NSFG Key Statistics page presents some of the most relied-upon findings from the survey based on data from the most recently available NSFG data (2015-2017), as well as key indicators from prior survey years

In order to understand and potentially improve upon NSFG’s continuous fieldwork design, offerors should consult the following methodology documentation.

The 3 NCHS reports (hyperlinked below) describe NSFG’s transition from a periodically conducted survey (1973-2002) to a continuous fieldwork design (starting 2006 and continuing throughout most recent fieldwork ending in 2019):

a. Planning and Development of the Continuous National Survey of Family Growth: Describes planning for and implementation of the transition from a periodic to a continuous survey, prior to the release of the first data from continuous interviewing.

b. The 2006-2010 National Survey of Family Growth: Sample Design and Analysis of a

Continuous Survey: Describes the sample design and weighting and variance estimation procedures under the continuous design, prior to the release of the first data from continuous interviewing.

https://www.cdc.gov/nchs/nsfg/index.htm https://www.cdc.gov/nchs/nsfg/nsfg_bibliography.htm https://www.cdc.gov/nchs/nsfg/nsfg_products.htm https://www.cdc.gov/nchs/nsfg/key_statistics_nsfg.htm https://www.cdc.gov/nchs/data/series/sr_01/sr01_048.pdf https://www.cdc.gov/nchs/data/series/sr_02/sr02_150.pdf https://www.cdc.gov/nchs/data/series/sr_02/sr02_150.pdf

c. Responsive Design, Weighting, and Variance Estimation in the 2006-2010 National Survey of Family Growth: Presents fieldwork results and weighting, imputation, and variance estimation procedures corresponding to the first release of data (2006-2010) under the continuous design.

Online documentation, posted on the NSFG webpage (hyperlinks below) for the 2015-2017 NSFG, describe the principles in the above three documents, as applied to the most recent file release from the continuous fieldwork design:

• Summary of design and data collection methods

• Sample design documentation

• Sample error estimation design

• Weighting design documentation

Other references used in the PWS:

1. Groves RM, Heeringa SG. 2006. Responsive Design for Household Surveys: tools for actively controlling survey errors and costs. Journal of the Royal Statistical Society A 169, Part 3: 439-457, April.

2. Shouten, B., Peytchev, A., & Wagner, J. 2017. Adaptive survey design. Boca Raton, FL: CRC Press.

3. Martinez GM, et al. 2006. Translating from English to Spanish: The 2002 National Survey of Family Growth.

Hispanic Journal of Behavioral Sciences 28 (4): 531-545.

4. The American Association for Public Opinion Research. 2015. Standard Definitions: Final Dispositions of Case

Codes and Outcome Rates for Surveys. 8th edition. AAPOR. Available at www.aapor.org.

3.2 Principal Concerns

To make the NSFG maximally useful for the purposes outlined above, the NCHS has identified six (6) principal concerns relating to the outcomes, results, and products of the survey. These are:

3.2.1 Continuity and responsiveness

In addition to maintaining a substantial set of core data that maintains comparability over the eight (8) years of data collection (about 90% of the questionnaires), the survey also has to respond to the needs of the federal programs that pay for the survey, and the clients and researchers they serve. This requires the NSFG staff and contractor to be open to making relatively small changes (specified below) in the questionnaire programs as often as once a year, and potentially larger changes every other year In other words, the NSFG staff and contractor have to maintain the quality, credibility, and relevance of the NSFG to policy concerns such as teen pregnancy, STDs and HIV, infertility, and the performance of family planning programs. These changes must be made with minimal changes to overall cost of contract performance.

3.2.2 Continuity and modernization

As stated in 3.2.1, continuity and comparability of core measures is key to the value of NSFG data, both with prior survey periods and within the years of data collection under this contract. To evaluate and maintain comparability and ensure data quality overall, careful experimental testing will be required for the use of modes other than face-to-face (OTFTF) to conduct the screener and main interviews. In addressing the tasks below related to this, offerors should include an assessment of the effect of OTFTF mode in the main interview, on analysis of trends in key estimates that pool data from 2017-2019 and earlier, with 2022 and later. (see 3.2.7 below and Section 4.10.)

3.2.3 Cost control and proactive management of fieldwork

Since the transition to continuous interviewing in 2006, the NSFG has been structured so that more resources, relative to periodic interviewing, are spent on efficient data collection and less on administrative and other tasks such as questionnaire programming or data file post-collection processing, Given increasing fieldwork costs for the https://www.cdc.gov/nchs/data/series/sr_02/sr02_158.pdf https://www.cdc.gov/nchs/data/series/sr_02/sr02_158.pdf https://www.cdc.gov/nchs/data/nsfg/PUF3-NSFG-2015-2017-Summary-of-DesignDataCollection_02Oct2019.pdf https://www.cdc.gov/nchs/data/nsfg/PUF3-NSFG-2015-2017-Sample-Design-Documentation_26Sept2019.pdf https://www.cdc.gov/nchs/data/nsfg/PUF3-NSFG-2015-2017-Sampling-Error-Estimation-Codes_26Sep19.pdf https://www.cdc.gov/nchs/data/nsfg/PUF3-NSFG-2015-2017-Weighting-Design_02Oct2019.pdf

NSFG and surveys in general, controlling fieldwork costs has become a central issue for surveys and will be required again for the fieldwork proposed here. Offerors should describe any potential cost savings opportunities stemming from the use of alternate (OTFTF) modes of screening households, conducting main interviews, and contacting respondents, if achievable while preserving response rates and other indicators of sample quality. (see Section 4.10). Contractor should consider cost-savings from allocating interviewer labor to where it is needed most to attain acceptable response rates and sample yield in all important sub-groups by age (teens and adults), gender (males and females), and race/ethnicity (Hispanics, non-Hispanic Whites, and non-Hispanic blacks). To attain cost-control goals, the contractor shall develop and maintain active cost and production monitoring systems. The system used in the contracts covering the 2002, 2006-10 and 2011-19 NSFG fieldwork allowed cost control through the ability to monitor and ration interviewer hours from the contractor’s headquarters (See Reference 1, 2, and Summary of design and data collection methods). Contractor is not required to use the same system, but whatever system is used should meet or exceed the standards set in prior designs, for timely monitoring of labor hours worked by interviewers and their production in terms of screener and main study interviews. Reports to NCHS shall be available within 24 to 48 hours, in the format described elsewhere. (Section 4.6.2, 4.6.8; Deliverables H1-H2)

3.2.4 Efficiency of data processing and data file documentation The NSFG is committed to maintaining the high standards of documentation and data processing it has provided in prior data releases. The NSFG is open to ideas for gains in efficiency through advances in this area but expects to maintain a collaborative and hands-on approach to the process. Examples of documentation for prior data releases can be seen on the NSFG web site at www.cdc.gov/nchs/nsfg.htm. (Section 4.7, 4.8; Deliverables K1-K9)

3.2.5 Collection of sensitive data

The NSFG collects information on many topics that are generally considered personally and sometimes politically sensitive, including abortion, contraceptive use, vaginal intercourse, and other types of sexual activity with different-sex and same-sex partners. For example, obtaining the best possible reporting of abortion by women, unplanned births, and HIV/STD risk-related behaviors by both men and women, are important goals of the NSFG.

Offerors are encouraged to provide their own analyses of the extant literature on the reporting of sensitive behaviors, and their own proposals to improve reporting in the NSFG. Offerors’ proposals to enhance reporting of sensitive behaviors should include the use of ACASI and may also include other methods of administration (such as web, mail, and telephone) and methods of delivery (e.g., tablets). (Section 4.10).

3.2.6 Collection of data requiring cognitively challenging tasks The NSFG contains series of questions asking for retrospective histories of events or behaviors over various time frames. The topics for which the NSFG asks for past dates include pregnancies, marriages and cohabitations, sexual intercourse and contraceptive method use (for the latter two, whether occurred in each month of the past 3 to 4 years), and dates of sex with sexual partners in the past 12 months. (Male respondents are not asked the month-by-month histories). While the time frames are roughly proportional to the difficulty of the recall task (ex: lifetime for the pregnancy history, but only past 12 months for dates of first and last sex with sexual partners), accurate recall is challenging and accuracy of data difficult to judge. Females use a paper calendar visual aid (Life History Calendar) to assist in placing events on a timeline, in relation to other events. A body of research exists on the value of life history calendars as aids. Offerors are encouraged to suggest improvements to the recall tasks and accuracy, including innovation in calendars (see Optional Contract Tasks, 4.12.3)

4. Specifications for Work Tasks: Baseline through release of first Public Use File (PUF) (Sept 2020 through Dec 2024)

4.1 Overview

The Contractor shall:

• Conduct the National Survey of Family Growth (NSFG), based upon a national sample of men and women

15-49, interviewed in person in their own homes, and/or using an alternative interview mode (detailed elsewhere in this document) in 2022-2029, with the first of 4 planned file releases containing data from interviews conducted in 2022-2023 and delivered in 2024.

https://www.cdc.gov/nchs/data/nsfg/PUF3-NSFG-2015-2017-Summary-of-DesignDataCollection_02Oct2019.pdf http://www.cdc.gov/nchs/nsfg.htm https://www.cdc.gov/nchs/data/nsfg/2015-2017_life_history_calendar.pdf

• Furnish all the necessary personnel, materials, services, facilities, and perform all other tasks necessary for, or incidental to, the performance of the work as described below, in accordance with the Schedule of Deliverables.

• Consult frequently and in depth with the COR and project staff to be designated, at all stages of questionnaire design, programming, and testing, and in the preparation of major deliverables including recode programs, imputations, and data file documentation.

While the COR will retain final responsibility for decisions on content and design, the contractor is encouraged to make suggestions at any time that will improve the quality and cost-effectiveness of the survey, on matters including but not limited to sample design, data collection (including mode) and fieldwork monitoring, fieldwork operations, screener wording and content, paradata file content, contextual data file content, and data file documentation technology and procedures.

4.2 Communication with NCHS

To facilitate close, frequent collaboration between NCHS and contractor staff, the contractor shall establish e-mail contact with the COR and designated NCHS project staff within two (2) business days of the contract award, and the contractor must establish procedures to maintain frequent contact throughout the contract. The COR and specific NCHS project staff expect to be in frequent, sometimes daily e-mail and telephone contact with contractor’s project team to collaboratively prepare materials such as questionnaire specifications, CAI program testing, recodes and imputation, data file documentation, and other project materials.

4.2.1 Kick-off meeting

Within 10 days of award, the Contractor’s Key Personnel shall meet with NCHS NSFG project staff to review the tasks and to discuss issues related to the conduct of the work. An NCHS Point of Contact (“Principal Investigator” in this PWS) with responsibility for specific tasks within this PWS may be designated by the COR.

The initial meeting shall take place at NCHS in Hyattsville, MD. Within 5 business days after the kick-off meeting, the Contractor shall submit minutes of the meeting and include the Contractor’s understanding of any significant issues needing clarification or further elaboration, including the schedule, staffing, management plans, and other matters (Deliverable B1).

4.2.2 Management Meetings

The contractor shall assume and budget for up to two meetings per year in person at NCHS or elsewhere in the

Washington, DC area. Two key staff from the contractor’s NSFG project team shall attend in person, with others connected by telephone or video conference. The contractor shall expect that members of the NCHS NSFG Project team will make a site visit at least once per year.

The Contractor shall consult with the COR to prepare an agenda for a formal Quarterly Meeting between the NCHS and Contract project teams every three months. Many of these meetings will be by telephone conference call, but some may be in person. The contractor shall prepare a PowerPoint Presentation for its report to the COR at each quarterly meeting, or provide complete notes in some other form acceptable to the COR. (Deliverable B2)

4.3 Information Security, Confidentiality, Disclosure Risk and Access to Confidential Data

The offeror’s proposed IT solution will be evaluated on its ability to effectively and efficiently meet the IT security requirements. Any/all electronic information or data collection systems used with US government information including but not limited to CUI, PII, etcetera in the performance of this contract must fall within an NCHS Security Authorization Boundary. Additionally, that system boundary must meet NCHS CIPSEA information protection requirements. In consideration of time constraints and to facilitate integration with authorized NCHS CIPSEA-approved operating environments, offerors that have previously deployed and achieved NCHS CIPSEA approval and CDC ATO are preferred.

4.3.1 Information Security, Confidentiality, and Disclosure Risk

1) Applicability. The requirements herein apply whether the entire contract or order (hereafter “contract”), or portion thereof, includes either or both of the following:

a. Access (Physical or Logical) to Government Information: A Contractor (and/or any subcontractor) employee will have or will be given the ability to have, routine physical (entry) or logical (electronic) access to government information.

b. Operate a Federal System Containing Information: A Contractor (and/or any subcontractor) employee will operate a federal system and information technology containing data that supports the HHS mission. In addition to the Federal Acquisition Regulation (FAR) Subpart 2.1 definition of “information technology” (IT), the term as used in this section includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources.

2) Safeguarding Information and Information Systems. In accordance with the Federal Information Processing Standards Publication (FIPS) 199, Standards for Security Categorization of Federal Information and Information Systems, the Contractor (and/or any subcontractor) shall:

a. Protect government information and information systems in order to ensure:

• Confidentiality, which means preserving authorized restrictions on access and disclosure, based on the security terms found in this contract, including means for protecting personal privacy and proprietary information;

• Integrity, which means guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity; and

• Availability, which means ensuring timely and reliable access to and use of information.

b. Provide security for any Contractor systems, and information contained therein, connected to an HHS network or operated by the Contractor on behalf of HHS regardless of location. In addition, if new or unanticipated threats or hazards are discovered by either the agency or contractor, or if existing safeguards have ceased to function, the discoverer shall immediately, within one (1) hour or less, bring the situation to the attention of the other party.

c. Adopt and implement the policies, procedures, controls, and standards required by the HHS Information Security Program to ensure the confidentiality, integrity, and availability of government information and government information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract. Obtain the HHS Information Security Program security requirements, outlined in the HHS Information Security and Privacy Policy (IS2P), by contacting the CO/COR.

d. Comply with the Privacy Act requirements and tailor FAR clauses as needed.

3) Information Security Categorization. The contractor and any sub-contractors shall handle/protect all information in accordance with FIPS 199 and National Institute of Standards and Technology (NIST) Special Publication (SP) 800-60, Volume II: Appendices to Guide for Mapping Types of Information and Information Systems to Security Categories, Appendix C, and based on information provided by the ISSO, CISO, or other security representative, the risk level for each Security Objective and the Overall Risk Level, which is the highest watermark of the three factors (Confidentiality, Integrity, and Availability) of the information or information system are the following:

Confidentiality: [ ] Low [ X ] Moderate [ ] High Integrity: [ ] Low [ X ] Moderate [ ] High Availability: [ X ] Low [ ] Moderate [ ] High Overall Risk Level: [ ] Low [ X ] Moderate [ ] High

Based on information provided by the ISSO, Privacy Office, system/data owner, or other security or privacy representative, it has been determined that this solicitation/contract involves:

[ ] No PII [ X ] Yes PII

PII Confidentiality Impact Level has been determined to be: [ ] Low [ X ] Moderate [ ] High

4) Personally Identifiable Information (PII). Per the Office of Management and Budget (OMB) Circular A-130, “PII is information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual.” Examples of PII include, but are not limited to the following: social security number, date and place of birth, mother‘s maiden name, biometric records, etc.

5) Controlled Unclassified Information (CUI). CUI is defined as “information that laws, regulations, or Government-wide policies require to have safeguarding or dissemination controls, excluding classified information.”

The Contractor (and/or any subcontractor) must comply with Executive Order 13556, Controlled Unclassified Information, (implemented at 32 CFR, part 2002) when handling CUI. 32 C.F.R. 2002.4(aa) As implemented the term “handling” refers to “…any use of CUI, including but not limited to marking, safeguarding, transporting, disseminating, re-using, and disposing of the information.” 81 Fed. Reg. 63323. All sensitive information that has been identified as CUI by a regulation or statute, handled by this solicitation/contract, shall be:

a. marked appropriately;

b. disclosed to authorized personnel on a Need-To-Know basis;

c. protected in accordance with NIST SP 800-53, Security and Privacy Controls for Federal Information Systems and Organizations applicable baseline if handled by a Contractor system operated on behalf of the agency, or NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations if handled by internal Contractor system; and

d. returned to HHS control, destroyed when no longer needed, or held until otherwise directed.

Destruction of information and/or data shall be accomplished in accordance with NIST SP 800-88, Guidelines for Media Sanitization.

6) Protection of Sensitive Information. For security purposes, information is or may be sensitive because it requires security to protect its confidentiality, integrity, and/or availability. The Contractor (and/or any subcontractor) shall protect all government information that is or may be sensitive in accordance with OMB Memorandum M-06-16, Protection of Sensitive Agency Information by securing it with a FIPS 140-2 validated solution.

7) Confidentiality and Nondisclosure of Information. Any information provided to the contractor (and/or any subcontractor) by HHS or collected by the contractor on behalf of HHS shall be used only for the purpose of carrying out the provisions of this contract and shall not be disclosed or made known in any manner to any persons except as may be necessary in the performance of the contract. The Contractor assumes responsibility for protection of the confidentiality of Government records and shall ensure that all work performed by its employees and subcontractors shall be under the supervision of the Contractor. Each Contractor employee or any of its subcontractors to whom any HHS records may be made available or disclosed shall be notified in writing by the Contractor that information disclosed to such employee or subcontractor can be used only for that purpose and to the extent authorized herein.

The confidentiality, integrity, and availability of such information shall be protected in accordance with HHS, CDC, and NCHS policies. Unauthorized disclosure of information will be subject to the applicable HHS, CDC, and NCHS sanction policies and/or governed by the following laws and regulations:

a. 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records);

b. 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information); and

c. 44 U.S.C. Chapter 35, Subchapter I (Paperwork Reduction Act).

8) Internet Protocol Version 6 (IPv6). All procurements using Internet Protocol shall comply with OMB Memorandum M-05-22, Transition Planning for Internet Protocol Version 6 (IPv6).

9) Government Websites. All new and existing public-facing government websites must be securely configured with Hypertext Transfer Protocol Secure (HTTPS) using the most recent version of Transport Layer Security (TLS). In addition, HTTPS shall enable HTTP Strict Transport Security (HSTS) to instruct compliant browsers to assume HTTPS at all times to reduce the number of insecure redirects and protect against attacks that attempt to downgrade connections to plain HTTP. For internal-facing websites, the HTTPS is not required, but it is highly recommended.

10) Software Assurance. The Contractor (and/or any subcontractor) shall ensure IT applications designed and developed for end users (including mobile applications and software licenses) run in the standard user context without requiring elevated administrative privileges.

a) The Contractor (and/or any subcontractor) shall follow secure coding best practice requirements, as directed by the United States Computer Emergency Readiness Team (US-CERT) specified standards and the Open Web Application Security Project (OWASP) that will limit system software vulnerability exploits.

b) The Contractor (and/or any subcontractor) shall ensure IT applications designed and developed for end users (including mobile applications and software licenses) run in the standard user context without requiring elevated administrative privileges.

c) The Contractor (and/or any subcontractor) shall follow secure coding best practice requirements, as directed by United States Computer Emergency Readiness Team (US-CERT) specified standards and the Open Web Application Security Project (OWASP), that will limit system software vulnerability exploits.

d) The Contractor (and/or any subcontractor) shall ensure that computer software developed on behalf of HHS or tailored from an open-source product, is fully functional and operates correctly on systems configured in accordance with government policy and federal configuration standards. The contractor shall test applicable products and versions with all relevant and current updates and patches updated prior to installing in the HHS environment. No sensitive data shall be used during software testing.

e) The Contractor (and/or any subcontractor) shall protect information that is deemed sensitive from unauthorized disclosure to persons, organizations or subcontractors who do not have a need to know the information. Information which, either alone or when compared with other reasonably-available information, is deemed sensitive or proprietary by HHS shall be protected as instructed in accordance with the magnitude of the loss or harm that could result from inadvertent or deliberate disclosure, alteration, or destruction of the data. This language also applies to all subcontractors that are performing under this contract.

f) The Contractor (and/or any subcontractor) shall remediate all risks or vulnerabilities immediately after the risks or vulnerabilities have been identified in the software.

11) Contract Documentation. The Contractor shall use provided templates, policies, forms and other agency documents to comply with contract deliverables as appropriate.

12) Standard for Encryption. The Contractor (and/or any subcontractor) shall:

a. Comply with the HHS Standard for Encryption of Computing Devices and Information to prevent unauthorized access to government information.

b. Encrypt all sensitive federal data and information (i.e., PII, protected health information [PHI], proprietary information, etc.) in transit (i.e., email, network connections, etc.) and at rest (i.e., servers, storage devices, mobile devices, backup media, etc.) with FIPS 140-2 validated encryption solution.

c. Secure all devices (i.e.: desktops, laptops, mobile devices, etc.) that store and process government information and ensure devices meet HHS and CDC-specific encryption standard requirements. Maintain a complete and current inventory of all laptop computers, desktop computers, and other mobile devices and portable media that store or process sensitive government information (including PII).

d. Verify that the encryption solutions in use have been validated under the Cryptographic Module Validation Program to confirm compliance with FIPS 140-2. The Contractor shall provide a written copy of the validation documentation to the COR.

e. Use the Key Management system on the HHS personal identification verification (PIV) card or establish and use a key recovery mechanism to ensure the ability for authorized personnel to encrypt/decrypt information and recover encryption keys. Encryption keys shall be provided to CDC Office of Chief Information Security Officer (OCISO).

13) Contractor Non-Disclosure Agreement (NDA). Each Contractor (and/or any subcontractor) employee having access to non-public government information under this contract shall complete the CDC non-disclosure agreement, as applicable. A copy of each signed and witnessed NDA shall be submitted to the Contracting Officer (CO) and/or CO Representative (COR) prior to performing any work under this acquisition.

14) Privacy Threshold Analysis (PTA)/Privacy Impact Assessment (PIA) – The Contractor shall assist the CDC Senior Official for Privacy (SOP) or designee with conducting a PTA for the information system and/or information handled under this contract in accordance with HHS policy and OMB M-03-22, Guidance for Implementing the Privacy Provisions of the E-Government Act of 2002.

a. The Contractor shall assist the CDC SOP or designee in reviewing the PIA at least every three years throughout the system development lifecycle (SDLC)/information lifecycle, or when determined by the CDC SOP that a review is required based on a major change to the system (e.g., new uses of information collected, changes to the way information is shared or disclosed and for what purpose, or when new types of PII are collected that could introduce new or increased privacy risks), whichever comes first.

B. Training

1) Mandatory Training for All Contractor Staff. All Contractor (and/or any subcontractor) employees assigned to work on this contract shall complete the applicable HHS/CDC Contractor Information Security Awareness, Privacy, and Records Management training (provided upon contract award) before performing any work under this contract.

Thereafter, the employees shall complete CDC Security Awareness Training (SAT), Privacy, and Records Management training at least annually, during the life of this contract. All provided training shall be compliant with HHS training policies.

2) Role-based Training. All Contractor (and/or any subcontractor) employees with significant security responsibilities (as determined by the program manager) must complete role-based training (RBT) within 60 days of assuming their new responsibilities. Thereafter, they shall complete RBT at least annually in accordance with HHS policy and the HHS Role-Based Training (RBT) of Personnel with Significant Security Responsibilities Memorandum.

All HHS employees and contractors with SSR who have not completed the required training within the mandated timeframes shall have their user accounts disabled until they have met their RBT requirement.

3) Training Records. The Contractor (and/or any subcontractor) shall maintain training records for all its employees working under this contract in accordance with HHS policy. A copy of the training records shall be provided to the CO and/or COR within 30 days after contract award and annually thereafter or upon request.

C. Rules of Behavior

1) The Contractor (and/or any subcontractor) shall ensure that all employees performing on the contract comply with the HHS Information Technology General Rules of Behavior.

2) All Contractor employees performing on the contract must read and adhere to the Rules of Behavior before accessing Department data or other information, systems, and/or networks that store/process government information, initially at the beginning of the contract and at least annually thereafter, which may be done as part of annual CDC Security Awareness Training. If the training is provided by the contractor, the signed ROB must be provided as a separate deliverable to the CO and/or COR per defined timelines above.

D. Incident Response FISMA defines an incident as “an occurrence that (1) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (2) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies. The HHS Policy for IT Security and Privacy Incident Reporting and Response further defines incidents as events involving cybersecurity and privacy threats, such as viruses, malicious user activity, loss of, unauthorized disclosure or destruction of data, and so on.

A privacy breach is a type of incident and is defined by Federal Information Security Modernization Act (FISMA) as the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where (1) a person other than an authorized user accesses or potentially accesses personally identifiable information or (2) an authorized user accesses or potentially accesses personally identifiable information for an other-than-authorized purpose.

OMB Memorandum M-17-12, “Preparing for and Responding to a Breach of Personally Identifiable Information” (03 January 2017) states:

Definition of an Incident:

An occurrence that (1) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (2) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.

Definition of a Breach:

The loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where (1) a person other than an authorized user accesses or potentially accesses personally identifiable information or (2) an authorized user accesses or potentially accesses personally identifiable information for an other-than-authorized purpose.

It further adds:

A breach is not limited to an occurrence where a person other than an authorized user potentially accesses PII by means of a network intrusion, a targeted attack that exploits website vulnerabilities, or an attack executed through an email message or attachment. A breach may also include the loss or theft of physical documents that include PII and portable electronic storage media that store PII, the inadvertent disclosure of PII on a public website, or an oral disclosure of PII to a person who is not authorized to receive that information. It may also include an authorized user accessing PII for another than authorized purpose.

The HHS Policy for IT Security and Privacy Incident Reporting and Response further defines a breach as “a suspected or confirmed incident involving PII”.

Contracts with entities that collect, maintain, use, or operate Federal information or information systems on behalf of CDC shall include the following requirements:

1) The contractor shall cooperate with and exchange information with CDC officials, as deemed necessary by the CDC Breach Response Team, to report and manage a suspected or confirmed breach.

2) All contractors and subcontractors shall properly encrypt PII in accordance with OMB Circular A-130 and other applicable policies, including CDC-specific policies, and comply with HHS-specific policies for protecting PII. To this end, all contractors and subcontractors shall protect all sensitive information, including any PII created, stored, or transmitted in the performance of this contract to avoid a secondary sensitive information incident with FIPS 140- 2 validated encryption.

3) All contractors and subcontractors shall participate in regular training on how to identify and report a breach.

4) All contractors and subcontractors shall report a suspected or confirmed breach in any medium as soon as possible and no later than 1 hour of discovery, consistent with…